Unable to connect hive in kerberos mode - hadoop

Question

Here is the code to connect to hive in kerberos mode
import java.sql.*;
import org.apache.hadoop.security.UserGroupInformation;
public class hive2 {
public static void main (String args[]) {
try {
org.apache.hadoop.conf.Configuration conf = new org.apache.hadoop.conf.Configuration();
conf.set("hadoop.security.authentication", "Kerberos");
UserGroupInformation.setConfiguration(conf);
UserGroupInformation.loginUserFromKeytab("hive/ambari2012.howard2012.local#HOWARD2012.LOCAL", "/etc/security/keytabs/hive.service.keytab");
Class.forName("org.apache.hive.jdbc.HiveDriver");
System.out.println("getting connection");
Connection con = DriverManager.getConnection("jdbc:hive2://ambari2012:10000/;principal=hive/ambari2012.howard2012.local#HOWARD2012.LOCAL");
System.out.println("got connection");
con.close();
}
catch (Exception e) {
e.printStackTrace();
}
}
}
the issue is doesnt matter what keytab I pass it's always giving the below error -
ERROR StatusLogger No log4j2 configuration file found. Using default configuration: logging only errors to the console.
java.io.IOException: Login failure for hive/ambari2012.howard2012.local#HOWARD2012.LOCAL from keytab /etc/security/keytabs/hive.service.keytab
at org.apache.hadoop.security.UserGroupInformation.loginUserFromKeytab(UserGroupInformation.java:921)
at hive.connect.java.hive.connect.java.App.main(App.java:21)
Caused by: javax.security.auth.login.LoginException: Unable to obtain password from user
I don't think it's even trying to check if the right keytab is given to it.
How should I ensure it's reading the correct keytab file and also if the keytab file is not present it should give unable to locate the keytab
Please let me know if I have to copy the keytab ,krb files in my local machine

Answer 1

I don't think you can connect to a kerberized HIVE this way.
Try using a JAAS file https://docs.oracle.com/javase/7/docs/technotes/guides/security/jgss/tutorials/LoginConfigFile.html
and add the 2 following properties to your JVM :
-Djavax.security.auth.useSubjectCredsOnly=False
-Djava.security.auth.login.config=jaas.conf
Sample file jaas.conf :
com.sun.security.jgss.krb5.initiate
{ com.sun.security.auth.module.Krb5LoginModule required
useKeyTab =true
useTicketCache =false
doNotPrompt =true
principal ="hive/ambari2012.howard2012.local#HOWARD2012.LOCAL"
keyTab ="/etc/security/keytabs/hive.service.keytab"
debug =false;
};
Client
{ com.sun.security.auth.module.Krb5LoginModule required
useKeyTab =true
useTicketCache =false
doNotPrompt =true
principal ="hive/ambari2012.howard2012.local#HOWARD2012.LOCAL"
keyTab ="/etc/security/keytabs/hive.service.keytab"
debug =false;
};

Answer 2

I was missing jar files so if you add all jar files it's fine, here is the complete code
import java.io.IOException;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.security.UserGroupInformation;
public class App {
private static Connection hiveConnection;
// get Hive Connection
public static void main(String [] args) throws IOException, SQLException {
String principal="principal";
String keytab="keytab";
Runtime rt = Runtime.getRuntime();
try{ Process p = rt.exec("kinit -k -t " + keytab + " " + principal);
p.waitFor(); }
catch(InterruptedException exception)
{
System.out.println("wait for threw an exception - it was interrupted");
exception.printStackTrace();
}
catch (IOException exception){
System.out.println("Exception in running kinit process") ;
exception.printStackTrace();
}
System.out.println("Preparing Hive connection1");
Configuration conf = new Configuration();
System.setProperty("javax.security.auth.useSubjectCredsOnly","false");
conf.set("hadoop.security.authentication", "Kerberos");
UserGroupInformation.setConfiguration(conf);
UserGroupInformation.loginUserFromKeytab(principal, keytab);
// Hive Connection
try {
Class.forName("org.apache.hive.jdbc.HiveDriver");
if(hiveConnection == null) {
hiveConnection = DriverManager.getConnection("jdbc:hive2://host:10000/;principal=principal;auth=kerberos;kerberosAuthType=fromSubject");
// return hiveConnection;
System.out.println("Got Connection");
} else {
//return hiveConnection;
}
} catch (ClassNotFoundException e) {
e.printStackTrace();
// return null;
} catch (SQLException e) {
e.printStackTrace();
// return null;
}
}
}